Microsoft Windows: Privilege escalation in Device Association Service

Summary

A use-after-free flaw in the Windows Device Association Service allows a local, authenticated attacker to elevate privileges. Microsoft states that exploitation requires winning a race condition. The vulnerability does not provide remote access on its own, but an attacker or malware with a foothold on a system could gain SYSTEM-level control.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
• Windows 10 Version 21H2 and 22H2: builds before 10.0.19045.7807 (21H2 build per CNA record: 10.0.19044.7807)
• Windows 11 Versions 23H2, 24H2, 25H2, 26H1, 26H2 and Windows Server 2022: see the MSRC update guide for exact builds

Fixed in

• October 2026 cumulative update for the affected Windows version (Microsoft Security Update Guide)
• Windows 10 1607 and Server 2016: fixed build 10.0.14393.9612 per CNA record; KB number unknown
• Windows 10 1809 and Server 2019: fixed build 10.0.17763.9376 (KB5126651 per third-party reference)

Workaround

Unknown. No Microsoft mitigation was found in the sources checked. An aggregator suggests disabling the Device Association Service or restricting its execution to high-trust accounts if the update cannot be deployed immediately; this is not verified by Microsoft.

Exploitation

• Not publicly disclosed and not known to be exploited (Microsoft)
• Microsoft exploitability assessment: Exploitation Less Likely
• CISA SSVC: exploitation none, not automatable, total technical impact
• No public proof of concept found in the sources checked; this is not confirmation that none exists

Our recommendation

• Identify all Windows 10 1607 and Windows Server 2016 systems and plan their upgrade, as the build is out of mainstream support; verify the lifecycle status in Microsoft's documentation
• Install the October 2026 cumulative update on all other affected systems, confirming the KB and build in the MSRC update guide first
• Limit local logons on shared workstations, terminal servers and file servers
• Monitor for unusual privilege changes and process activity on these systems

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83710 msrc.microsoft.com
• Microsoft Security Update Guide (en-US): CVE-2026-83710 msrc.microsoft.com
• Vulners CVE List record (CNA JSON): CVE-2026-83710 vulners.com
• OpenCVE: CVE-2026-83710 app.opencve.io
• Vulners NVD record: CVE-2026-83710 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:28.